ML17319A667
| ML17319A667 | |
| Person / Time | |
|---|---|
| Site: | Sequoyah  |
| Issue date: | 11/16/2017 |
| From: | Dennis Bley Advisory Committee on Reactor Safeguards |
| To: | Mccree V NRC/EDO |
| Nourbakhsh H | |
| References | |
| Download: ML17319A667 (8) | |
Text
UNITED STATES NUCLEAR REGULATORY COMMISSION ADVISORY COMMITTEE ON REACTOR SAFEGUARDS WASHINGTON, DC 20555 - 0001 November 16, 2017 Mr. Victor M. McCree Executive Director for Operations U.S. Nuclear Regulatory Commission Washington, DC 20555-0001
SUBJECT:
STATE-OF-THE-ART REACTOR CONSEQUENCE ANALYSIS (SOARCA)
PROJECT: SEQUOYAH INTEGRATED DETERMINISTIC AND UNCERTAINTY ANALYSES
Dear Mr. McCree:
During the 648th meeting of the Advisory Committee on Reactor Safeguards, November 2-3, 2017, we reviewed the draft report on "State-of-the-Art Reactor Consequence Analysis (SOARCA) Project: Sequoyah Integrated Deterministic and Uncertainty Analyses." Our Subcommittee on Regulatory Policies and Practices also reviewed this matter during meetings held on May 19, 2016, June 6, 2017, and October 18, 2017. During these meetings, we had the benefit of discussions with representatives of the NRC staff and their contractors. We also had the benefit of the referenced documents.
CONCLUSIONS AND RECOMMENDATIONS
- 1. The Sequoyah SOARCA study has significantly advanced the understanding of severe accident progression in a pressurized-water reactor with an ice condenser containment.
It demonstrates the importance of an integrated assessment of uncertainties that account for the best available knowledge about equipment performance, thermal-hydraulic phenomena, and emergency planning.
- 2. This study evaluates the conditional site-specific consequences from a short-term and a long-term station blackout scenario, which are tailored to examine the effects from hydrogen generation, ignition, and containment failure vulnerability. It does not examine other scenarios that may be important for containment failure or bypass, and it does not account for accident mitigation equipment and strategies that have been implemented at Sequoyah. The results from this study should not be extrapolated to other pressurized-water reactors with ice condenser containments at other sites.
- 3. The Sequoyah SOARCA report should be published after the staff more clearly documents the following issues and additional research needed for their resolution:
potentially important modeling uncertainties, justification for safety valve failure rates, and MELCOR failures to complete some simulations involving an early stuck-open pressurizer safety valve.
- 4. The staff should examine and resolve the issues regarding safety valve failure rates and MELCOR performance before further enhancements are made to the SOARCA studies.
BACKGROUND In NUREG-1935, "State-of-the-Art Reactor Consequence Analyses (SOARCA) Report," the staff published the methods, models, and initial results from integrated accident progression and consequence analyses for the Peach Bottom and Surry nuclear power plants. The analyses focused primarily on accidents involving a short-term station blackout (STSBO) scenario and a long-term station blackout (LTBSO) scenario at each plant1. The Peach Bottom analyses also examined an additional scenario involving loss of power at a particular vital AC bus, while the Surry analyses examined additional scenarios involving a steam generator tube rupture initiating event and an interfacing system loss-of-coolant accident. The scope of those analyses was informed by previous conclusions about potentially important contributions to the risk at each of those plants. The analyses quantified radionuclide releases and offsite health consequences that are conditional on the selected core damage event scenarios. The studies did not estimate the frequencies of those scenarios or the consequences from the full spectrum of scenarios in a probabilistic risk assessment. Therefore, the SOARCA studies are not intended to be integrated assessments of the risk to the public. Furthermore, the original Peach Bottom and Surry studies reported only "point estimate" results, without an evaluation of the inherent uncertainties in those estimates.
Subsequent to the original studies, focused uncertainty analyses were performed for the LTSBO scenario at Peach Bottom and the STSBO scenario at Surry. The Surry analyses were also expanded to include an enhanced examination of thermally-induced failures of steam generator tubes after the onset of core damage. The analyses evaluated uncertainties in selected parameters from the MELCOR models for severe accident progression and containment response and uncertainties in parameters from the MACCS models for offsite releases, emergency response, and public health effects. In most cases, the uncertainties were retrofit around the "point estimate" values used in the original studies. These studies demonstrated the feasibility of performing an integrated uncertainty analysis, and they supported the development of methods for sampling parametric uncertainties in each of the major modeling codes. They also provided important insights about how consideration of the uncertainties affects understanding and interpretation of the results from the original studies.
The Peach Bottom and Surry studies examined severe accident scenarios for a boiling-water reactor with a Mark I containment and a pressurized-water reactor (PWR) with a large dry containment. The Sequoyah study extends the scope of the SOARCA analyses to include a focused evaluation of severe accident response for a PWR with an ice condenser containment.
It is intended specifically to examine the effects from hydrogen generation and release, timing and locations of ignition, and containment vulnerability to failure caused by a highly energetic deflagration. To that end, the study evaluates only an STSBO scenario and an LTSBO scenario. An integrated assessment of the effects on offsite emergency response is facilitated by the assumption that each scenario is caused by a very severe earthquake, which also damages the infrastructure surrounding the site. The study intentionally omits evaluations of other potentially important phenomena, such as failures of reactor coolant pump seals and containment bypass scenarios caused by thermally-induced failures of steam generator tubes.
1 In a "short-term" station blackout, systems that do not rely on AC power (e.g., turbine-driven auxiliary feedwater, reactor core isolation cooling, etc.) fail coincidentally with the initiating event. In a "long-term" station blackout, those systems continue to operate until the station batteries are depleted.
Preliminary analyses concluded that the LTSBO scenario has much lower importance for early failures of the containment due to hydrogen burns2. Therefore, only a limited number of sensitivity calculations are performed for that scenario. An integrated uncertainty analysis is performed for the STSBO scenario.
DISCUSSION The SOARCA studies have significantly advanced the methods, models, and computational tools for evaluating severe accidents. Perhaps more importantly, they have also improved the knowledge and practical experience of the staff and their contractors, who performed these integrated analyses for specific plants, event scenarios, and sites.
As with the previous SOARCA studies, this study is not an evaluation of the public health risk from the Sequoyah nuclear power plant. It examines the accident progression and consequences from only two selected scenarios, and it does not evaluate how often those scenarios may occur. The analyses are simplified further by examining only "unmitigated" conditions. They do not account for personnel actions that may prevent core damage, alter the scenario progression, or reduce offsite releases. In particular, the study does not include the additional equipment and improved severe accident mitigation guidance that has been implemented in response to the accident at Fukushima Daiichi. Because the study intentionally omits other phenomena that could exacerbate the accident progression and offsite releases, and it omits strategies to mitigate the accident, its results should not be interpreted as an accurate characterization of the actual conditional consequences from station blackout events at Sequoyah.
The evolution of this study has demonstrated the importance of an integrated assessment of uncertainties that account for the best available knowledge about equipment performance, thermal-hydraulic phenomena, and emergency planning. The results are influenced substantially by the ranges and the shapes of the uncertainty distributions. Critical examinations of the uncertainties have identified topics for future research. Those examinations have also identified issues that are relatively unimportant to the results from these particular analyses, despite the existence of rather large uncertainty. These conclusions and insights cannot be supported in a meaningful way by a process that retrofits arbitrary uncertainties about nominal "point estimate" parametric values after the analyses are completed. The Sequoyah SOARCA experience demonstrates that the uncertainty analyses are a key element of the scientific and engineering knowledge that forms the technical basis for the entire study.
The Sequoyah study also demonstrates the importance of performing fully-integrated scenario-specific and site-specific analyses. The offsite emergency response models and analyses are based on site-specific emergency planning information from the Sequoyah plant, the local communities, and the Tennessee Emergency Management Agency. They also account for the population distribution, configuration of roadways, and meteorology in the area surrounding the site. Thus, the conditional consequence results from this study cannot be extrapolated to other sites.
Unlike the previous SOARCA studies, the Sequoyah models for offsite emergency response account explicitly for the assumption that each of the station blackout scenarios is caused by a 2 In this study, an "early" failure means that the containment fails within approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the start of core damage.
very severe earthquake. The models for mobilization of transportation resources, transit times, and available evacuation routes account for damage to bridges and other elements of the infrastructure in the emergency planning zone. Uncertainties in the times for relocating specific segments of the population are also increased to account for the unknown extent of the seismic damage. Sensitivity studies examine the effects from extended sheltering in place with varying amounts of structural damage, compared to the nominal evacuation times. These elements of the analyses demonstrate the importance of an integrated evaluation of onsite and offsite effects from accidents that involve coincident damage from strong earthquakes, flooding, severe storms, and other local or regional hazards.
The SOARCA studies have implemented successively more thorough analyses of uncertainties in several parameters from the MELCOR and MACCS models. However, they have never documented careful examinations of possible modeling uncertainties. As demonstrated by the lessons learned from the Sequoyah parametric uncertainty analyses, those modeling uncertainties may have an even more significant effect on the results and insights. The Sequoyah study includes sensitivity analyses that examine the benefits from hydrogen igniters, effects from reactor coolant pump seal failures, turbine-driven auxiliary feedwater operating time and battery life in the LTSBO scenario, shelter-in-place duration and shielding, weather sampling, and four thresholds for the dose-response models. Rather than ad hoc selection of sensitivity analyses, a systematic process should be carried out to identify uncertainties in all aspects of the models for in-vessel accident progression, reactor coolant system failure, reactor vessel breach, containment failure, release pathways, and offsite emergency response. The process would continue by describing each identified uncertainty, considering its potential importance, and performing sensitivity studies on those judged to be most important. Full quantification of the modeling uncertainties would be the long-term goal.
The Sequoyah study concludes that pressurizer safety valve failures to reclose are the most important contribution to early failure of the containment due to hydrogen burns. Safety valve failures to reclose were also identified as important in the Surry SOARCA analyses. The staff made substantial efforts during the Sequoyah study to investigate available estimates for the valve failure rates, examine recent operating experience, and develop an engineering-based uncertainty distribution for the size of the open area if a valve does not reclose. The models account for successive demands on each of the three safety valves, and the uncertainty sampling methods are elegant. Despite these efforts, two important issues remain unresolved.
Safety Valve Failure Data Estimates for the safety valve failure rate were derived initially from NUREG/CR-7037. Data for pressurizer safety valves and main steam safety valves at PWRs were pooled, due to general similarities in the valve characteristics and very few operational demands for pressurizer safety valves. Testing data were excluded, due to indications that test protocols for the failure mode of interest do not replicate conditions that are expected during a severe accident. These considerations are appropriate. The staff also examined additional industry operating experience from 2007 through early 2016 to supplement the data in NUREG/CR-7037.
The staff has acknowledged that substantial judgment was needed to derive estimates for the number of safety valve demands (i.e., the denominator for the failure rate). The relatively large number of demands tabulated in NUREG/CR-7037 and in the staff's supplemental estimates do not seem consistent with general PWR operating experience with infrequent demands to open the main steam safety valves. Based on our reviews and discussions with the staff, we could
not determine whether the number of demands may be significantly over-estimated. Fewer demands would produce a higher calculated safety valve failure rate, which would increase the overall conditional probability of early containment failure.
The staff should justify the bases for the number of safety valve demands in NUREG/CR-7037 and in the more recent assessment. If the estimates cannot be substantiated by actual industry operating experience, additional research should be performed and data compiled to evaluate realistic failure rates.
MELCOR Failure to Complete Simulations The baseline Sequoyah analyses contain a rather small number of MELCOR realizations for scenario conditions that may result in an early containment failure (i.e., a stuck-open pressurizer safety valve with an open area that exceeds approximately 30%). Of those realizations, about 60% ran to completion; and approximately 17% of those resulted in early containment failure.
The staff performed a focused study using a much larger number of samples to more thoroughly investigate this particular regime of the accident progression. That study identified essentially the same behavior. A similar proportion failed to complete. Approximately 17% of the completed runs resulted in early containment failure. The focused study improves confidence in the conditional probability of early containment failure for those MELCOR realizations that ran to completion.
The staff did a preliminary forensics analysis of the MELCOR simulations that failed to complete. A significant percentage of these ran for sufficient time to determine whether or not containment failure would occur. That examination increases confidence that a similar percentage of those runs may result in early containment failure. These forensic analyses should be documented.
The staff has yet to determine the root causes for why these MELCOR simulations failed to complete in this particular regime. The staff should more thoroughly examine the behavior of MELCOR for these conditions, document the reasons why these simulations do not run to completion, and determine whether there is any impact on the probability of early containment failure.
Summary The Sequoyah study has significantly advanced the understanding of severe accident progression in a PWR with an ice condenser containment. It contains a wealth of information, models, and analytical methods. Publication of the study report should not be delayed until the issues regarding model uncertainties, safety valve failure rates, and MELCOR performance are fully resolved. However, the report should more clearly describe these issues and the need for further investigation of each. The staff should more thoroughly examine and resolve the issues regarding safety valve failure rates and MELCOR performance to support a fundamental
understanding of these elements of PWR severe accident progression before further enhancements are made to the SOARCA studies.
Dr. Dana A. Powers did not participate in the Committee's deliberations on this matter.
Sincerely,
/RA/
Dennis C. Bley Chairman REFERENCES
- 1. U.S. Nuclear Regulatory Commission, NUREG-1935, "State-of-the-Art Reactor Consequence Analyses (SOARCA) Report," November 2012 (ML12332A057).
- 2. U.S. Nuclear Regulatory Commission, NUREG/CR-7155, "State-of-the-Art Reactor Consequence Analyses Project: Uncertainty Analysis of the Unmitigated Long-Term Station Blackout of the Peach Bottom Atomic Power Station," May 2016 (ML16133A461).
- 3. U.S. Nuclear Regulatory Commission, "State-of-the-Art Reactor Consequence Analyses Project: Uncertainty Analysis of the Unmitigated Short-Term Station Blackout of the Surry Power Station," Draft, August 2015 (ML15224A002).
- 4. U.S. Nuclear Regulatory Commission, "State-of-the-Art Reactor Consequence Analyses (SOARCA) Project: Sequoyah Integrated Deterministic and Uncertainty Analyses," Draft, April 2016 (ML16119A218).
- 5. U.S. Nuclear Regulatory Commission, "State-of-the-Art Reactor Consequence Analysis (SOARCA) Project, Sequoyah Integrated Deterministic and Uncertainty Analyses," Draft, May 2017 (ML17156A255).
- 6. U.S. Nuclear Regulatory Commission, "State-of-the-Art Reactor Consequence Analysis (SOARCA) Project: Sequoyah Integrated Deterministic and Uncertainty Analyses," Draft, September 2017 (ML17264A644).
- 7. U.S. Nuclear Regulatory Commission, "State-of-the-Art Reactor Consequence Analyses (SOARCA) Project: Sequoyah Integrated Deterministic and Uncertainty Analyses, Executive Summary," Draft, October 2017 (ML17278A759).
- 8. U.S. Nuclear Regulatory Commission, NUREG/CR-7037, "Industry Performance of Relief Valves at U.S. Commercial Nuclear Power Plants through 2007," March 2011 (ML110980205).
- 9. U.S. Nuclear Regulatory Commission, Information Paper, Safety Valve Failure Determination & Demand Data Estimation, October 2017 (ML17305A435).
- 8. U.S. Nuclear Regulatory Commission, NUREG/CR-7037, "Industry Performance of Relief Valves at U.S. Commercial Nuclear Power Plants through 2007," March 2011 (ML110980205).
- 9. U.S. Nuclear Regulatory Commission, Information Paper, Safety Valve Failure Determination & Demand Data Estimation, October 2017 (ML17305A435).
Accession No: ML17319A667 Publicly Available Y Sensitive N Viewing Rights: NRC Users or ACRS Only or See Restricted distribution OFFICE ACRS/TSB SUNSI Review ACRS/TSB ACRS ACRS NAME HNourbakhsh HNourbakhsh MBanks AVeil DBley (AV for)
DATE 11/15/2017 11/15/2017 11/16/2017 11/16/2017 11/16/2017 OFFICIAL RECORD COPY